Put a hidden variable parameter in to some of the requests that you control (e.g. from your servlet, or from your javascript window.open), so if it is has your value, you know where the request came from. And if it is not there, or has a different value, then you know the request is not from those specific sources.